class Fluent::Plugin::ShodanSearch

Constants

SUPPORTED_FILTERS

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_shodan_search.rb, line 47
def configure(conf)
  super

  @client = Shodanz.client.new(key: @api_key)
  begin
    log.info "Shodan client properly registered", client_info: @client.info
  rescue RuntimeError => exception
    raise Fluent::ConfigError.new "Invalid Shodan API key"
  end

  raise Fluent::ConfigError.new("At least a query or one filter should be configured") if @query.empty? and @filters.empty?

  @search_filters = {}
  @filters.each do |filter|
    @search_filters[filter.name] = filter.value
  end
end
multi_workers_ready?() click to toggle source
# File lib/fluent/plugin/in_shodan_search.rb, line 65
def multi_workers_ready?
  false
end
start() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_shodan_search.rb, line 69
def start
  super

  timer_execute("shodan_#{self.class.name}_#{@tag}".to_sym, @interval, repeat: true, &method(:run))
end

Private Instance Methods

run() click to toggle source
# File lib/fluent/plugin/in_shodan_search.rb, line 77
def run
  log.debug "Starting Shodan search", query: @query, max_pages: @max_pages
  es_time = Fluent::EventTime.now
  opts = @search_filters.merge({page: 0})
  read_entries = 0
  loop do
    opts[:page] += 1
    log.trace query: @query, opts: opts
    result = @client.host_search(@query.dup, **opts)
    result['matches'].each do |rec|
      router.emit(@tag, es_time, rec)
    end
    read_entries += result['matches'].length
    break if (@max_pages >= 0 && opts[:page] >= @max_pages) || read_entries >= result['total']
  end
  log.debug "Shodan search ending", query: @query, filters: @search_filters, total_read: read_entries
rescue RuntimeError => re
  log.error "Unable to execute Shodan query", query: @query, filters: @search_filters, page: current_page, error: re
rescue => exception
  log.error "Error executing Shodan query", error: exception
end